the most direct way would be to keep your developer key on a web server/service, prove to the service somehow (with your own application logic) that you were allowed to retrieve the developer key, and then get it from the service and use it to connect to Stratus.

Except that the "somehow" is really not going to happen, because the code can be decompiled, and Adobe has not provided any way to keep some protected data on the client side OR even uniquely identify a particular instance of an AIR app. Unless I am wrong and someone can explain how...